i 



Attorney Docket: 42P18636X 

CLAIMS 



What is claimed is: 



1 1 . A method for securely transferring data across an optical-switched (OS) network, 

2 comprising: 

3 generating, at least one edge node in the OS network, security keys including an 

4 encryption key and a decryption key; 

5 distributing, for said at least one edge node, the encryption key to at least one other 

6 edge nodes in the OS network; 

7 encrypting, at a source edge node, data to be sent from the source edge node to a 

8 destination edge node, said data encrypted with an encryption key distributed by the 

9 destination node and received by the source node; 

10 sending the data along a virtual lightpath between the source and destination edge 

1 1 nodes, the virtual lightpath spanning at least one lightpath segment; and 

12 decrypting, at the destination edge node, the encrypted data that are sent, said 

13 encrypted data being decrypted with the decryption key generated by the destination node. 

1 2. The method of claim 1 , wherein the OS network comprises an optical burst-switched 

2 (OBS) network. 

1 3. The method of claim 2, wherein the OBS network comprises a photonic burst- 

2 switched (PBS) network. 

1 4. The method of claim 2, wherein the PBS network comprises a wavelength-division 

2 multiplexed (WDM) PBS network. 
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1 5. The method of claim 1, wherein the security keys are generated and distributed by: 

2 generating a respective asymmetric key pair including an encryption and decryption 

3 key at each edge node in the OS network; and 

4 for each edge node, 

5 distributing the encryption key it generated to each of the other edge nodes. 

1 6. The method of claim 1 , wherein the encryption key comprises a public key and the 

2 decryption key comprises a private key, and wherein security keys are distributed by: 

3 for at least one edge node; 

4 receiving a digital certificate at a receiving edge node, the digital certificate 



5 containing a public key corresponding to a private key generated by a generating edge node, 

6 wherein the public key is to be used to encrypt data send from the receiving edge node to the 

7 generating edge node. 



1 7. The method of claim 6, further comprising: 

2 generating a self-signed digital certificate at the generating edge node; and 

3 sending the digital certificate to the receiving edge node. 

1 8. The method of claim 6, further comprising: 

2 generating security data including the public key at the generating edge node; 

3 sending the security data to a certificate authority, the certificate authority to issue an 

4 authenticated digital certificate containing the public key; and 

5 receiving the authenticated digital certificate at the receiving edge node. 

1 9. The method of claim 8, further comprising: 

2 generating a respective set of security data at each edge node; and 
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3 sending the respective set of security data from each edge node to the certificate 

4 authority. 

1 1 0. The method of claim 1 , further comprising: 

2 employing a trusted platform module (TPM) to generate an asymmetric key pair 

3 comprising the encryption key and the decryption key. 

1 11. The method of claim 10, further comprising: 

2 employing the TPM to securely store the decryption key in a manner by which it 

3 cannot be accessed by an unauthorized agent. 



1 12. The method of claim 1 1 , wherein the decryption key is securing stored by performing 

2 operations including: 

3 dynamically generating a security key with the TPM; 

4 encrypting one of a decryption key or a digital certificate containing a decryption key 

5 using the security key; 

6 measuring an integrity metric corresponding to a platform configuration; 

7 storing the integrity metric in a platform configuration register (PCR) 

8 sealing the security key against the TPM using a TPM_Seal command referencing the 

9 PCR. 



1 13. The method of claim 1 , further comprising: 

2 employing a trusted platform module (TPM) accessible to edge node that receives an 

3 encryption key to securely store the encryption key in a manner by which it cannot be 

4 accessed by an unauthorized agent. 
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1 14. The method of claim 1, further comprising sending encryption keys to said at least 

2 one other edge node using a communication channel that is external to the OS network to 

3 distribute the security keys. 

1 15. The method of claim 1, further comprising sending encryption keys to said at least 

2 one other edge node using an out-of-band channel of the OS network to distribute the 

3 security keys. 

1 16. The method of claim 1 5, further comprising sending security data via a control burst 

2 for the OS network, the security data including one or more security keys or containing 

3 information from which one or more security keys can be derived. 

1 17. The method of claim 1 , further comprising sending information to each edge node 

2 identifying at least one of an encryption algorithm and decryption algorithm to be employed 

3 to encrypt and/or decrypt the data via the security keys. 

1 18. The method of claim 1 7, further comprising sending encryption and/or decryption 

2 code to an edge node, the encryption and/or decryption code to be executed to perform 

3 encryption and/or decryption operations. 

1 19. A method for securely transferring data across an optical-switched (OS) network, 

2 comprising: 

3 performing one of dynamically generating or selecting an encryption and decryption 

4 key at a source edge node in the OS network; 

5 building a control burst, the control burst containing information to reserve network 

6 resources to form a virtual lightpath between the source edge node and a destination edge 

7 node during a scheduled timeslot, the virtual lightpath including at least one lightpath 
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8 segment, the control burst further including security data comprising one of the decryption 

9 key or data from which the decryption key can be derived; 

10 sending the control burst to the destination edge node; 

1 1 encrypting, at a source edge node, data to be sent from the source edge node to a 

1 2 destination edge node, said data encrypted with the encryption key; 

13 sending the encrypted data along the virtual lightpath between the source and 

14 destination edge nodes during the timeslot for which the virtual lightpath is reserved, and 

15 decrypting, at the destination edge node, the encrypted data that are sent, said 

16 encrypted data being decrypted with a decryption key comprising one of the decryption key 

1 7 include with the security data sent via the control burst or a decryption key derived from the 

18 security data. 



1 20. The method of claim 19, wherein the OS network comprises an optical burst-switched 

2 (OBS) network. 

1 21. The method of claim 20, wherein the OBS network comprises a photonic burst- 

2 switched (PBS) network. 

1 22. The method of claim 20, wherein the PBS network comprises a wavelength-division 

2 multiplexed (WDM) PBS network. 

1 23. The method of claim 19, further comprising: 

2 dynamically generating the encryption and decryption keys using a trusted platform 

3 module located at the source edge node. 



1 
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24. The method of claim 23, wherein the encryption and decryption keys comprises a 
single symmetric key. 
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1 25. The method of claim 23, wherein the encryption and decryption keys comprises an 

2 asymmetric key pair. 

1 26. The method of claim 19, further comprising: 

2 time-bounding the decryption key so the decryption key will expire after a pre- 

3 defined timeframe; and 

4 determining if the decryption key has expired prior to enabling the data to be 

5 decrypted at the destination edge node, wherein decryption is not allowed if the decryption 

6 key has expired. 

1 27. The method of claim 19, wherein the security data sent via the control burst further 

2 includes information identifying an encryption algorithm to be employed to encrypt the data 

3 sent to the destination node. 

1 28. A machine-readable medium to provide instructions, which when executed by a 

2 processor in a source edge node of an optical switched (OS) network cause the source edge 

3 node to perform operations including: 

4 encrypting data to be sent to a destination edge node using an encryption key; 

5 generating a control burst, the control burst containing information to reserve network 



6 resources to form a virtual lightpath between the source edge node and the destination edge 

7 node during a scheduled timeslot, the virtual lightpath including at least one lightpath 

8 segment, the control burst further including security data comprising one of a decryption key 

9 or data from which the decryption key can be derived; 

10 sending the control burst to the destination edge node; and 

1 1 sending one or more data bursts containing the data that are encrypted to a first hop 

12 along the virtual lightpath during the scheduled timeslot. 
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1 29. The machine-readable medium of claim 28, wherein execution of the instructions 

2 further perform the operation of generating one of a symmetric session key or an asymmetric 

3 session key pair, the session key or key pair including the encryption key and the decryption 

4 key. 

1 30. The machine-readable medium of claim 28, wherein execution of the instructions 

2 performs the further operation of sending a command to a trusted platform module (TPM) to 

3 generate a symmetric session key or an asymmetric session key pair, the session key or key 

4 pair including the encryption key and the decryption key. 

1 31. The machine-readable medium of claim 28, wherein execution of the instructions 

2 performs the further operation of selecting a symmetric session key or an asymmetric session 

3 key pair for a set of security keys which may be accessed by the source edge node. 

1 32. The machine-readable medium of claim 28, wherein execution of the instructions 

2 performs the further operation of embedding information in the control burst identifying said 

3 one or more data bursts to be sent from the edge node to the destination edge node will be 

4 encrypted. 

1 33. The machine-readable medium of claim 28, wherein the security data include one of 

2 information identifying an encryption algorithm used to encrypt the data or executable code 

3 that may be used to decrypt the certificate. 

1 34. A system comprising: 

2 at least one processor; 

3 memory communicatively-coupled to said at least one processor; 
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4 an encryption component; 

5 a trusted platform module (TPM), communicatively-coupled to said at least one 

6 processor; 

7 an optical interface; and 

8 a storage device in which instructions are stored, said instructions to perform 

9 operations when executed by said at least one processor, including: 

10 commanding the TPM to generate one of a symmetric session key or an 

1 1 asymmetric session key pair, the session key or key pair including an encryption key 

1 2 and a decryption key. 

13 invoking the encryption component to encrypt, using the encryption key, data 

14 to be sent to a destination edge node operatively linked in communication to the 

15 system via a photonic burst-switched (PBS) network, the system to operate as a 

1 6 source edge node; 

17 generating a control burst, the control burst containing information to reserve 

18 PBS network resources to form a virtual lightpath between the source edge node and 

19 the destination edge node during a scheduled timeslot, the virtual lightpath including 

20 at least one lightpath segment, the control burst further including security data 

2 1 comprising one of the decryption key or data from which the decryption key can be 

22 derived; 

23 sending the control burst to a first hop along the virtual lightpath, the first hop 

24 comprising one of a switching node or the destination edge node; and 

25 sending one or more data bursts containing the data that are encrypted to a 

26 first hop along the virtual lightpath during the scheduled timeslot. 

1 35. The system of claim 34, wherein said at least one processor includes a network 

2 processor. 
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1 36. The system of claim 34, wherein said at least one processor includes an ingress 

2 network processor and an egress network processor. 

1 37. The system of claim 34, wherein the encryption component comprises a hardware 

2 device programmed to perform encryption operations. 

1 38. The system of claim 34, wherein the encryption component is embodied as a software 

2 module comprising a plurality of instructions to effectuate encryption operations when 

3 executed on a processor. 

1 39. The system of claim 34, further comprising a decryption component configured to 

2 decrypt data received from the PBS network. 

1 40. The system of claim 39, wherein the decryption component comprises a hardware 

2 device programmed to perform decryption operations. 

1 41. The system of claim 39, wherein the decryption component is embodied as a software 

2 module comprising a plurality of instructions to effectuate decryption operations when 

3 executed on a processor. 

1 42. The system of claim 39, wherein the decryption component is used to determine if a 

2 time-bound decryption key has expired prior to enabling the data to be decrypted, wherein 

3 decryption is not allowed if the decryption key has expired 

1 43. The system of claim 34, wherein execution of the instructions by said at least one 

2 processor further performs the operation of embedding information in the control burst 
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3 identifying said one or more data bursts to be sent from the edge node to the destination edge 

4 node will be encrypted. 

1 44. The system of claim 34, wherein execution of the instructions by said at least one 

2 processor further performs the operation of time-bounding the decryption key such that the 

3 encryption key will expired after a pre-determined timeframe. 
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